PERFORMANCEMeet Your Users Where They Are with Obs.js
Harry Roberts introduces Obs.js, a tiny library that reads browser signals — latency, bandwidth, Data Saver mode, battery level, CPU, and memory — and exposes them as CSS classes on the html element and a window.obs JavaScript object. The library distinguishes between Statuses (factual device conditions) and Stances (opinions derived from them), such as deliveryMode, canShowRichMedia, and shouldAvoidRichMedia. On Roberts' own site, Obs.js switches between a full high-res image stack and an LQIP-only fallback depending on inferred delivery mode, with SpeedCurve data showing only an 80ms LCP gap across 8,742 page views. Beyond UI adaptation, it doubles as an analytics segmentation layer, enabling questions like INP by device tier or Data Saver prevalence in your audience.
Read Articlearrow_forward Article · PERFORMANCEREAD TIME: 13m
From Latency to Instant: Modernizing GitHub Issues Navigation Performance
GitHub's Issues Performance team overhauled navigation latency by layering three complementary strategies. First, a client-side cache backed by IndexedDB with stale-while-revalidate semantics moved React soft navigations from 4% instant to 22% instant (33% cache-hit ratio). Second, preheating — proactively populating cache for high-intent issue references without enforcing freshness — pushed instant navigations to 30% overall and 70% for React paths, raising cache-hit ratio to 96%. Third, a service worker intercepts hard navigations and signals the server to return a thin HTML shell when issue data is already cached locally, enabling React to render from local data even on cold starts. The team measured success using an internal HPC metric aligned with LCP, bucketed into Instant (under 200ms), Fast (under 1000ms), and Slow tiers. Across the full rollout, P10 dropped from 600ms to 70ms and P50 from 1200ms to 700ms, shifting the majority of navigations into the fast bucket.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 17m
GitHub Actions Cache Poisoning Is Eating Open Source
Neciu Dan documents the mechanics and defenses of GitHub Actions cache poisoning, a supply-chain attack pattern that compromised Angular (research disclosure, 2024), tj-actions/changed-files (23,000+ downstream workflows, March 2025), Cline (4,000 developers, February 2026), and TanStack (84 malicious versions across 42 packages in six minutes, May 2026). The attack exploits GitHub's shared cache pool across trust boundaries: a low-privilege pull_request_target workflow that checks out fork code can write a poisoned dependency store under the same cache key a release workflow will later restore. Because cache writes use a runner-internal token separate from the workflow's GITHUB_TOKEN, restricting workflow permissions does not prevent cache poisoning. The article provides a 10-point remediation checklist: replace pull_request_target with pull_request where possible, disable caching in workflows with id-token: write, pin all third-party actions to commit SHAs, sanitize untrusted event inputs (especially in AI triage bots), add zizmor or actionlint as required PR checks, add CODEOWNERS to .github/, migrate to OIDC trusted publishing, enforce FIDO2 2FA, and configure minimum package age policies in pnpm or yarn.
READ_FULL_LOGarrow_forwardArticle · ARCHITECTUREREAD TIME: 10m
We Replaced Redis with MySQL for Inventory Reservations — and It Scaled
Shopify's engineering team replaced a Redis-based inventory reservation system with MySQL, achieving correctness and scalability goals through MySQL 8's SKIP LOCKED feature. The new design uses one row per sellable unit with a bounded pool capped at 1,000 rows per item/location combination, enabling ACID transactions across reservation and inventory ledger operations that Redis could not provide atomically. Key implementation lessons include using a composite primary key to reduce InnoDB lock count from two per row to one, switching transaction isolation to READ COMMITTED to avoid gap locks during replenishment, and standardizing lock acquisition order across reservation and claim paths to eliminate deadlocks. The team discovered the real throughput ceiling was connection pool exhaustion from unrelated checkout code — diagnosed by tagging SQL statements with business-process identifiers at the application layer and tracking hold time at the ProxySQL layer. Cleanup reduced reads by 50% and transactions by 33%, allowing the system to sustain Black Friday-level traffic with writer CPU under 50%.
READ_FULL_LOGarrow_forwardArticle · CAREERREAD TIME: 6m
Don't Outsource the Learning
Addy Osmani argues that the default AI-assisted coding workflow — paste spec, accept output, ship — is optimized for closing tasks rather than building durable understanding. He cites three studies: an Anthropic randomized trial finding that engineers who copy-pasted AI-generated code scored 40% on comprehension quizzes versus 65% for those who used AI for conceptual questions; the MIT "Your Brain on ChatGPT" EEG study (arXiv 2506.08872) showing reduced brain connectivity and 83% of LLM users unable to quote what they just wrote; and a CHI 2026 paper showing that LLM anchoring at the start of a task degraded decision quality even when the human did subsequent work independently. The practical corrective is a posture shift within existing tools: form a hypothesis before prompting, ask for explanation before code, treat AI output like a PR from a junior engineer, and re-derive AI-written code by hand occasionally to calibrate skill drift.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 18m
The pull_request_target Trap
Sascha Becker provides an in-depth analysis of the pull_request_target GitHub Actions trigger that enabled six major open-source supply-chain attacks between August 2025 and May 2026: Nx (QUIETVAULT credential stealer, August 2025), PostHog (reviewer assignment workflow exploited over 74 days, November 2025), Trivy/LiteLLM (poisoned upstream scanner, February-March 2026), a prt-scan campaign targeting 500+ repos (March-April 2026), and TanStack (84 malicious npm versions, May 2026). The article anatomizes the TanStack chain in three steps: a fork PR plants a poisoned pnpm store via a bundle-size benchmark workflow, the cached store is restored on a later push to main with release permissions, and malicious binaries dump the OIDC token from runner process memory via /proc/pid/mem. The core defense is the two-workflow pattern: run untrusted fork code in a pull_request workflow with no secrets or caches, then hand artifacts to a separate workflow_run workflow with elevated permissions. The article also notes that restricted permissions (contents: read) do not block cache writes or in-memory OIDC token scraping, since both bypass the GITHUB_TOKEN permission model entirely.
READ_FULL_LOGarrow_forwardArticle · PERFORMANCEREAD TIME: 16m
A 10MB API Response Costs 66ms Before Your Code Even Runs
Ko-Hsin Liang presents controlled benchmarks and a static-analysis scan measuring the real cost of large API payloads in Node.js v22. Five benchmark modules (BM-01 through BM-05) show that JSON.parse of a 10MB payload takes 66ms — blocking the Node.js event loop entirely — while chunked parsing of 100KB pieces takes 6.38ms, a 10x improvement. At the query level, unbounded ORM fetches versus paginated 100KB chunks deliver a 1,246x speedup at 10MB because chunking keeps V8 allocations within the young-generation heap, avoiding the full Mark-Compact GC pause that a single large parse triggers. A Babel AST scan of 277 public Node.js API repos found 64.6% had at least one large-payload anti-pattern, with 32,829 unbounded findAll/findMany calls, 17,069 deep nested includes, and 2,112 SELECT * occurrences. The fix recommendations are architectural: enforce explicit limits on every ORM list call, adopt cursor pagination for all list endpoints, and flatten nested includes only when the flat structure carries fewer total objects.
READ_FULL_LOGarrow_forwardsummarizeDigest_Summary
Two high-impact performance articles led the week. Harry Roberts introduced Obs.js, a small library that reads browser signals — latency, bandwidth, Data Saver mode, battery, CPU, and memory — and exposes them as CSS classes on the html element and a window.obs object. It distinguishes factual Statuses from derived Stances like deliveryMode and canShowRichMedia, enabling progressive UI adaptation with only an 80ms LCP gap in SpeedCurve data across 8,742 page views. On the backend, Shopify replaced Redis with MySQL for inventory reservations using MySQL 8's SKIP LOCKED feature, achieving ACID guarantees Redis could not provide atomically. Key implementation lessons include composite primary keys to cut InnoDB lock count in half, READ COMMITTED isolation to avoid gap locks during replenishment, and unified lock acquisition order to eliminate deadlocks. The fix reduced reads by 50% and transactions by 33%, sustaining Black Friday-level traffic with writer CPU under 50%.
GitHub's Issues team documented a three-layer navigation performance overhaul: an IndexedDB client-side cache with stale-while-revalidate semantics moving instant navigations from 4% to 22%, cache preheating for high-intent issue references pushing instant navigations to 30% overall and 70% for React paths, and a service worker intercepting hard navigations to signal thin HTML shell responses when data is already cached. P10 latency dropped from 600ms to 70ms across the full rollout. A Node.js API payload study found that JSON.parse of a 10MB payload blocks the event loop for 66ms, while 100KB chunked parsing takes 6.38ms — a 10x gap — and a Babel AST scan of 277 public repos found 64.6% had at least one large-payload anti-pattern including 32,829 unbounded ORM findAll/findMany calls.
Addy Osmani published a research-backed essay arguing that the default AI coding workflow optimizes for task completion over durable learning, citing an Anthropic RCT (40% vs 65% comprehension), the MIT Brain on ChatGPT EEG study (arXiv 2506.08872), and a CHI 2026 paper on LLM anchoring degrading decision quality. The practical correctives — forming hypotheses before prompting, requesting explanations before code, treating AI output like a junior PR — position AI as an augmentation tool rather than a replacement for engineering judgment. A companion article dissected six open-source supply-chain attacks enabled by pull_request_target from August 2025 to May 2026, mapping the TanStack attack chain step by step and providing a 10-point remediation checklist including replacing pull_request_target with the two-workflow pattern.
Key Takeaways- Obs.js gives you browser-signal-aware CSS classes (deliveryMode, canShowRichMedia) with only an 80ms LCP trade-off — use it as both a progressive enhancement layer and an analytics segmentation tool for audience-specific INP and Data Saver prevalence data.
- GitHub's Issues navigation went from 4% instant to 30% instant overall (70% on React paths) by layering IndexedDB stale-while-revalidate caching, preheating for high-intent links, and a service worker that signals thin HTML shell responses —
P10 latency dropped from 600ms to 70ms. - A 10MB JSON payload blocks the Node.js event loop for 66ms; chunking to 100KB drops that to 6.38ms. A scan of 277 public repos found 64.6% had at least one unbounded ORM list call — cursor pagination and explicit ORM limits are mandatory, not optional.
